About Chainlink
Chainlink is the industry-standard oracle platform bringing the capital markets onchain and powering the majority of decentralized finance (DeFi). The Chainlink stack provides the essential data, interoperability, compliance, and privacy standards needed to power advanced blockchain use cases for institutional tokenized assets, lending, payments, stablecoins, and more. Since inventing decentralized oracle networks, Chainlink has enabled tens of trillions in transaction value and now secures the vast majority of DeFi.
Many of the world’s largest financial services institutions have also adopted Chainlink’s standards and infrastructure, including Swift, Euroclear, Mastercard, Fidelity International, UBS, S&P Dow Jones Indices, FTSE Russell, WisdomTree, ANZ, and top protocols such as Aave, Lido, GMX and many others. Chainlink leverages a novel fee model where offchain and onchain revenue from enterprise adoption is converted to LINK tokens and stored in a strategic Chainlink Reserve. Learn more at chain.link.
About the Role
The Manager, Insider Trust will lead Chainlink Labs’ Insider Trust function while remaining directly involved in technical investigations and detection development. This player-coach role is responsible for protecting sensitive data, investigating potential insider risk, and strengthening our ability to identify and address concerning activity.
Your Impact
Lead, develop, and mentor the Insider Trust team.
Direct and conduct investigations involving sensitive data, systems, and workforce activity.
Build and improve detections, monitoring, and escalation workflows for insider risk.
Ensure investigations are timely, proportionate, well documented, and supported by defensible evidence.
Partner with Legal, People, IT, and Security throughout the investigation and response lifecycle.
Identify control gaps and translate investigative findings into lasting technical and process improvements.
Establish metrics that demonstrate program effectiveness, investigative quality, and detection coverage.
Communicate sensitive findings clearly to both executive and working-level stakeholders.
Requirements
7+ years of experience in insider risk, detection engineering, security operations, incident response, digital forensics, data protection, threat hunting, or a related security field.
2+ years leading an insider risk, investigations, or closely related security team.
Demonstrated ability to lead a team while remaining hands-on in technical investigations and detection development.
Experience managing the full investigation lifecycle, including scoping, evidence collection, timeline development, analysis, documentation, escalation, and lessons learned.
Strong knowledge of digital forensics, evidence preservation, chain of custody, incident-response coordination, and case management.
Experience partnering with Legal and People teams on sensitive workforce investigations.
Sound understanding of the legal, privacy, confidentiality, and employee-relations considerations associated with workforce investigations.
Experience working in software, financial services, or another industry that handles highly sensitive data.
Strong written and verbal communication skills, sound judgment, and the ability to operate discreetly in high-trust situations.
Preferred Qualifications
Experience working in a remote-first and globally distributed company.
Experience investigating data movement across email, cloud storage, collaboration platforms, source-code repositories, build systems, artifact stores, browsers, AI tools, removable media, and unmanaged or partially managed devices.
Hands-on experience with SIEM, DLP, or endpoint telemetry
Experience developing queries, analytics, or automation to identify and investigate suspicious behavior.
Experience establishing investigation playbooks, escalation criteria, program metrics, and detection coverage.
Experience leading projects, reviewing technical designs, and mentoring engineers or investigators.
Working knowledge of blockchain technology, including hardware wallets and signing operations.
All roles with Chainlink Labs are global and remote-based. Unless otherwise stated, we ask that you try to overlap some working hours with Eastern Standard Time (EST).
We carefully review all applications and aim to provide a response to every candidate within two weeks after the job posting closes. The closing date is listed on the job advert, so we encourage you to take the time to thoughtfully prepare your application. We want to fully consider your experience and skills, and you will hear from us regarding the status of your application shortly after the closing date.
Commitment to Equal Opportunity
Chainlink Labs is an equal opportunity employer. All qualified applicants will receive equal consideration for employment in compliance with applicable laws, regulations, or ordinances. If you need assistance or accommodation due to a disability or special need when applying for a role or in our recruitment process, please contact us via this form.
Global Data Privacy Notice for Job Candidates and Applicants
Information collected and processed as part of your Chainlink Labs Careers profile, and any job applications you choose to submit, is subject to our Recruiting Privacy Policy. By submitting your application, you are agreeing to our use and processing of your data as required.
